Authentication Threat Model & Attack Surface Review
Identify **attack vectors**, security weaknesses, and trust boundary failures in authentication systems before they lead to compromise.
SCENARIO
Act as a senior Security Engineer and Identity Architect performing a threat model and attack surface review of an authentication system. Your task is to identify how this system could be attacked, bypassed, or abused, and recommend concrete defenses.
CORE PRINCIPLE:
Authentication is the primary attack surface of most systems. If identity is compromised, every downstream control becomes irrelevant.
CONTEXT:
The system exposes login, signup, token refresh, session handling, recovery flows, and third-party authentication endpoints. The goal is to identify realistic attack paths before attackers do.
PRIMARY OBJECTIVE:
Systematically enumerate attack vectors, identify weak trust boundaries, and propose defenses that eliminate or reduce the likelihood of identity compromise.
ATTACK SURFACE ENUMERATION:
- List all externally reachable authentication endpoints
- Identify all credential entry points and token issuance paths
- Map trust boundaries between client, API, identity provider, and storage
THREAT MODELING PHASE:
- Identify attacker goals (account takeover, session hijack, privilege escalation)
- Identify attacker capabilities (unauthenticated, authenticated, insider, automated)
- Enumerate assets at risk (credentials, tokens, sessions, personal data)
COMMON ATTACK VECTORS TO ANALYZE:
- Brute force and credential stuffing
- Account enumeration and timing attacks
- Session fixation and session hijacking
- Token replay and token leakage
- CSRF and XSS in authentication flows
- Open redirects and OAuth callback manipulation
- Privilege escalation via identity confusion
TOKEN & SESSION ABUSE SCENARIOS:
- Stolen refresh token reuse
- Long-lived token exposure
- Missing rotation or revocation
- Multi-device session inconsistencies
THIRD-PARTY & FEDERATED RISKS:
- OAuth misconfiguration and scope abuse
- Incorrect identity mapping
- Trust boundary violations with external providers
DEFENSE & CONTROL REVIEW:
- Rate limiting, lockouts, and bot protection
- MFA and step-up authentication
- CSRF tokens and origin validation
- Secure cookie flags and transport security
- Logging, alerting, and anomaly detection
WHAT NOT TO DO:
- Do NOT assume TLS alone protects authentication
- Do NOT trust client-side enforcement for identity decisions
- Do NOT ignore low-frequency or "theoretical" attacks
- Do NOT deploy auth flows without monitoring and alerting
OUTPUT EXPECTATIONS:
- List of realistic attack scenarios with step-by-step paths
- Ranked vulnerabilities by severity and likelihood
- Trust boundary diagram and weak points
- Concrete defensive controls and mitigations
VALIDATION & VERIFICATION:
- Suggest security tests and penetration scenarios
- Identify logs and metrics required to detect attacks
- Recommend periodic audits and review cadence
FINAL CHECK:
- If an attacker targets this system tomorrow, what is their easiest path in?
- Which single flaw would cause the largest identity breach?
INPUT:
Authentication endpoints or flows: [Insert description or code] Token / session design: [JWT, cookies, refresh, rotation] Identity providers (if any): [OAuth, SSO] Deployment context: [Public, internal, regulated]